KR101280050B1 - Location-based security system for portable electronic device - Google Patents

Abstract

PURPOSE: A location based security system for a portable device is provided to secure a portable electronic device. CONSTITUTION: When a current location corresponds to a familiar area, a CPU(Central Processing Unit)(605) executes a first authentication process. When the current location does not belong to the familiar area, the CPU executes a second authentication process. The CPU receives a plurality of user authentication entries. The CPU determines a location of a device corresponding to the successful user authentication entries. The CPU stores data indicating the corresponding location of the entries. The CPU outputs a prompt for executing the authentication process through a user interface. [Reference numerals] (620) Disk controller; (625) Memory; (640) Display interface; (645) Display; (650) Communication ports; (655) Interface; (660) Keyboard; (665) Input device

Description

Location-based security system for portable electronic devices {LOCATION-BASED SECURITY SYSTEM FOR PORTABLE ELECTRONIC DEVICE}

Typically, portable electronic devices such as smart phones, personal digital assistants (PDAs), laptop computers, tablet computing devices, media players, and the like, lock the device until the user is authenticated to the device. Use security settings to enable Typically, authentication methods include an entry of a passcode. Some devices may include biometric authentication means, such as a fingerprint entry, but these features may add to the cost of the device. Thus, passcodes are still the most common form of authentication.

Although passcode authentication is convenient and simple from the end-user's perspective, some users do not like entering passwords repeatedly on electronic devices, and these users are not a nuisance due to password entry at all. They can also be disabled (security features). This leaves the device insecure and exposes your data to other people.

This disclosure describes improved methods for securing a portable electronic device.

In one embodiment, the portable electronic device receives a request for access to itself. This access request can be an overall access request, such as pressing a button or touch screen to wake up the electronic device from a locked state. Or, such an access request can be another request, such as a request to access a particular application or function on an electronic device. Without requiring the user to enter any location information, the processor of the device may determine a familiar area for that electronic device and determine whether the device is within this familiar area. If the device is located in a familiar area, the device will implement a first security rule that requires a first authentication process. On the other hand, if the device is not located in a familiar area, the device will implement a second security rule that requires a second authentication process. The second security rule may be more complex or require more time than the first security rule. The device determines its current location, and (i) performs the first authentication process if the device is in a familiar area, or (ii) the second authentication process if the device is not in a familiar area. You can present a prompt to the user.

Depending on the option, the device can automatically determine the second familiar area without requiring a user entry of location information. In the case of determining the second familiar area, when the device is located in the second familiar area, the device may perform a third authentication process.

To determine familiar regions, the device may consider successful user authentication entries and data indicative of the corresponding location of each entry. For example, when the device receives successful user authentication entries, the device determines the device location for each successful user authentication entry, and stores data indicative of each successful entry and its location in computer-readable memory. You can save it. Determining the location of the device includes receiving global positioning system (GPS) data, determining the location based on the GPS data, and receiving a network address corresponding to the wireless communication network the device is using. And determining the location based on the network address or other methods. If the memory contains at least a threshold number of entries for a location, the processor may classify that location as a familiar area.

Alternatively, familiar regions determine a set of successful user authentication entries received over a period of time, group entries from this set into location-dependent subsets, and determine the size and angle of the set. By determining the size of the subgroup and identifying each subgroup having a size at least equal to a size threshold corresponding to a portion of the size of the set. For each subgroup having a size at least equal to the size threshold, the device may classify the location for entries in that subgroup as a familiar area. Categorizing entries from the set into location dependent subsets may include identifying entries with locations that are within a threshold distance from each other, and grouping the identified entries into one of the subgroups.

As another alternative, determining a familiar area may include automatically and periodically collecting location information for the device, storing location information in memory, accessing stored location information, and at least a threshold amount of location information stored in memory. May be determined automatically, and setting the determined location as a familiar area.

As another alternative, determining the familiar area automatically and periodically collects location information for the device, which location includes GPS data and wireless network data, wherein the device is a Global Positioning System (GPS). Identifying from a transition (frequently or repeatedly transition within a period of time) from to a single wireless network, and setting the identified location as a familiar area.

1 illustrates a system that can be used to determine the location of a portable electronic device.
2 is a flow chart illustrating elements of an example of authentication by a location process.
3 is a block diagram of hardware that may be used to include or implement program instructions in accordance with one embodiment.

The present disclosure is not limited to the specific systems, devices, and methods described, as these may vary. The terminology used herein is for the purpose of describing particular versions or embodiments only and is not intended to limit the scope of the invention.

As used herein, the singular forms “a”, “an” and “the” include plural references unless the context clearly dictates otherwise. Unless defined otherwise, all technical and scientific terms used herein have the same meanings as commonly understood by one of ordinary skill in the art. Nothing in this disclosure should be construed as an admission that the embodiments described in this disclosure are not entitled to precede such disclosure by the prior invention. As used herein, the term "comprising" means "including, but not limited to." The terms "sum", "product", and similar mathematical terms used herein are broadly interpreted to include any method or algorithm in which a single data is obtained or calculated from a plurality of input data. .

For the purposes of this document, "passcode" refers to any input that can be used to authenticate a user of an electronic device. For example, a passcode can be letters, numbers, icons or other symbols, voice prompts or other that can be used to authenticate a user requesting access to an electronic device. It may contain a sequence of characters, such as characters. Alternatively, the passcode may include a biometric identifier, such as a fingerprint recognition or face recognition technique.

1 illustrates a system 10 that can be used to provide location based security functionality on a portable electronic device 12. In this document, a "portable electronic device" includes a processor; Tangible computer-readable memory; And a communication link 18, such as a transceiver or communication port, that enables the device to transmit and receive signals over one or more wireless communication networks. Portable electronic devices may include, for example, smart phones, personal digital assistants, laptop computers, tablet computing devices, media players, and the like. The electronic device 12 may include a display 14 and one or more input sensors 16, such as touch screen elements and / or buttons, keys, switches, etc. of the display.

The electronic device 12 can transmit and receive data via one or more communication networks 32 and 22. For example, one or more communication towers 20 may relay data and / or voice signals to the device via the wireless network 22. A wi-fi network 32 or similar hotspot may send and receive signals from router 30 or similar device. The satellite 50 may transmit or receive signals 52 such as, for example, satellite positioning system (GPS) location data to or from the device. Optionally, server 60 may communicate with one or more networks such that it may transmit information to and / or receive information from the device.

Many existing electronic devices are configured to automatically enter a secured or locked state when not in use for a certain amount of time. The user then requires the user to perform an authentication process to transition the device from the secure state (the user cannot use the device) to the insecure state (the user can use the device and access the device's functionality). I can receive it. Examples of authentication processes include entry of passcodes, facial recognition methods, voice recognition patterns, gestures and other currently known or future known authentication techniques. For example, the device may include a display such as a touch screen with a touch-sensitive field 14 that the user must swipe or place on his finger. The authentication required by the touch sensitive field can be simply a finger stroke or a biometric technique such as a fingerprint reader. The display or keypad of the device may accept an authentication code, such as a personal identification number (PIN) or passcode. An audio input, such as a microphone, may accept authentication, such as a passcode or PIN, that is voice-entered. An image sensor, such as a camera, can capture an image of a user so that the device can perform face recognition. The near field communications (NFC) sensor may detect when the device is within the communication range of the token rather than issue a passcode via the NFC signal. Any or all of these authentication methods may be implemented by programming instructions, which instructions may be stored in memory and may be stored in memory and may be stored in a memory of the electronic device, or of a remote server in electronic communication with the electronic device via a wireless or wired communication network. Used by the processor.

In addition to various authentication methods, the amount of time required before the device moves from a secure state to an insecure state may vary by device. In general, users of electronic devices do not want very short lock timeouts because the user has to re-enter his password or other authentication very frequently. On the other hand, if the device has a longer timeout before moving from an insecure state to a secure state, the device will not be protected during this time. The methods described below can assist a user by providing a simpler authentication process to the user when the device is in a location where the user generally uses the telephone, such as the user's home or office. When the smartphone is not located in a known secure area, a more complex authentication process may be required.

2 illustrates a process that may be used to implement a location based security system for an electronic device. The device may implement programming instructions to automatically determine the familiar area of the device. Familiar local determination can be performed without any need or consideration for user-entered location information. Instead, the system may determine a familiar location through any combination of satellite positioning system (GPS) data, network identification information, successful precode entry data, and / or other data.

For example, a device may be programmed to automatically collect location information for the device, such as by retrieving GPS location data or network address and storing the location information in memory. In addition to collecting location information for the network that the device is using, the device may collect location information for one or more other networks that are within range of the device and that the device detects. Such collection may occur periodically, such as after a certain minutes. Alternatively, this collection may be prompted by the occurrence of an event, such as a successful authentication event, a device change from an unlocked state to a locked state, launching an application, or any other action.

The processor accesses the stored location information and automatically determines 105 that this location information is a familiar location at least a threshold amount stored in memory. The threshold amount may be, for example, a threshold number of locations detected over a recent time period, a total threshold level, or a threshold ratio of all locations stored in memory over the immediately preceding time period. For example, the system may collect and store location information on a timely basis and store this information in memory for five days. As new location information is collected, the oldest information can be purged from memory. When the device analyzes the data, it may determine that any location (eg, GPS data or network address) that constitutes at least 15 percent of the stored data corresponds to a familiar location for the user (105). Alternatively, the device may set the most frequent places threshold, such as multiple locations (e.g., top five), each corresponding to more stored data than any other location. It is available. Other thresholds and time periods are possible.

In addition, multiple thresholds may be required for any location to be classified as a familiar location. For example, to be a familiar location, a location corresponds to 10 percent of the stored data, and may need to be ranked as the top five of all locations in the stored data. As another variant, the thresholds may vary depending on the particular combination. For example, the familiar location may be a location that constitutes 10 percent of the data and is ranked as numbers 1-5, but if the location is within rank numbers 6-10, a 5 percent data threshold may be applied.

Alternatively, the device may determine familiar areas based on locations where the user repeatedly enters a number of successful user authentication entries. For example, whenever a device receives a successful authentication entry, the device may store data corresponding to the location where the entry was received (121). The location data may be GPS data, network address data, or any other information that provides evidence of the location of the device. Such location data is stored with a time stamp or other time based indication and may be removed after a time period. Alternatively, the data may simply be stored in the received order and removed when there is a threshold number of entries in memory. For example, the device may store location data for the 50 most recent successful passcode entries, and when a new entry is received, the oldest entry is removed. Thereafter, the device determines the locations where successful authentication entries are most frequent, such as by determining locations where at least a threshold number of successful authentications occurred, or by determining locations where at least a critical percentage (eg, 20 percent) of successful authentication code entries occurred. Determining locations may occur 125. The system can then determine the familiar areas where the most successful authentication inputs were most frequent, such as where one or both of the thresholds were the same or exceeded (107).

A single "familiar area" can correspond to more than one GPS location data point or more than one network address. For example, an office complex may have a range of GPS coordinates. Thus, when determining familiar regions, the system groups the successful entries into one or more location dependent subgroups (103, 123); Determine the size of the entire set of successful entries and the size of each subgroup; Identify each subgroup having a size at least equal to a size threshold corresponding to a known fraction, ratio, or other portion of the set size; The location of each subgroup having a size at least equal to the size threshold can be identified as a familiar area. Subgroups can be created by grouping entries with locations that are within a threshold distance (such as 20 meters, or any other distance) from each other. For example, a user's office may have multiple GPS coordinates or use multiple Wi-Fi networks, depending on where the user is located within the office. By grouping close proximity to each other into subgroups, each subgroup can be analyzed to determine if it constitutes a familiar area. Proximity areas may be areas that are determined to be within a critical distance from each other, such as by GPS data, known network locations or other information.

In some embodiments, determining 107 the familiar area may include identifying a location where the device transitions from one network to another. This may indicate, for example, that the device has transitioned to using a known Wi-Fi network (which indicates that the device has moved from the outdoors, perhaps to the user's office) from a cellular network (which indicates that the device is outdoors). . Alternatively, the device may move from a location where no known networks are detected to an area where at least one known network is detected. If this happens, or if it is repeated at least a critical number of times within a known time period, the device may record as a familiar area the Wi-Fi network that the device transitions to.

When a device is in a secure state, such as being locked out, such that a passcode must be entered before the user can access any one or all of the devices' applications or features, the device must A request to access the electronic device may be received (109). This access request can be a touch screen stroke of the device, a button press, a voice command, or any other detected input from the user.

In response to the access request, the device may compare the current GPS, network address or other data with the stored familiar locations to determine if the device is physically located within the familiar area (111). If the device is in a familiar area, the device may enforce a security rule that requires a first authentication procedure (115). If the device is not located in a familiar area, the device may implement a second security rule that requires a second authentication procedure (113). The device may then prompt the user to perform the applicable authentication process. The determination of whether the device is in a familiar area can be made automatically, without requiring any user input or even presenting the result of this determination to the user.

The first authentication process 115 corresponding to the familiar area may be less complicated or less cumbersome than the second process 113. For example, the first process may have a longer timeout period than the second process, meaning that if the device is in a familiar area, it will remain insecure for a longer period of time. In another example, when the device is in a familiar area, the first authentication process may require a shorter passcode, or no passcode, and may only require touch input, such as a finger stroke, or a voice prompt. have. As another option, the second authentication process may require more actions than the first process. For example, the first authentication process may require entry of a passcode, while the second authentication process may require both entry of a passcode and detection of a known token, such as an NFC chip within range of an electronic device.

In some embodiments, different authentication processes may be authorized for different familiar regions. For example, the system may determine whether the device is in a fairly familiar area by determining whether the device is in the area where it is most frequently present (117). In addition, when determining familiar regions, the system may determine that any region where the device is present above the upper threshold (such as 20% of the time) is considered to be "highly faimilar". Consider, any region where the device is at or below the upper threshold but above the lower thershold can be ranked as familiar, thereby ranking the familiar regions. The authentication process for a fairly familiar area may be a third authentication process 119 that is much less complicated or less cumbersome than the first process. For example, the third process may have a longer timeout period than the first and second processes, or no timeout period at all.

3 is a block diagram of example hardware used to include or implement program instructions in accordance with one embodiment. The bus 600 serves as a primary information pathway that connects the different illustrated components of the hardware to each other. The CPU 605 is the central processing unit of the system and performs the calculations and logical operations necessary to execute the program. Read only memory (ROM) 610 and random access memory (RAM) 615 constitute exemplary memory devices.

Controller 620 interfaces one or more optional memory devices 625 to system bus 610. Such memory devices 625 may include, for example, an external or internal DVD drive, CD ROM drive, hard drive, flash memory, USB drive, or the like. As indicated previously, these various drives and controllers are optional devices.

Program instructions may be stored in ROM 610 and / or RAM 615. Optionally, the program instructions may be, for example, a tangible computer readable storage medium such as a hard disk, compact disk, digital disk, flash memory, memory card, USB drive, Blu-ray ^™. optical disc storage media such as disc), and / or other recording media.

Optional display interface 640 allows information from bus 600 to be displayed on display 645 in audio, visual, graphical or alphanumeric format. Communication with external devices may take place using various communication ports 650. Communication port 650 may be attached to a communication network, such as the Internet or an intranet.

The hardware may also include an interface 655, which may include input devices such as a keyboard 660, such as a mouse, joystick, touch screen, remote control, pointing device, Enable reception of data from other input devices 665 such as a video input device and / or an audio input device.

Alternatives as well as the features and functions disclosed above may be combined into many other different systems or applications. Various alternatives, modifications, variations, or improvements that are currently unpredictable or unpredictable may be made by those skilled in the art, each of which is also intended to be encompassed by the disclosed embodiments.

Claims (21)

As a method for securing an electronic device,
Receiving, via an input of a portable electronic device, a request to access the electronic device;
Automatically determining, by the processor, a familiar area for the electronic device without requiring a user entry of location information;
On the electronic device, when the electronic device is physically located within the familiar area, implement a first security rule that requires a first authentication process, and wherein the electronic device is located outside of the familiar area. Enforcing a second security rule that requires a second authentication process;
Receiving, via input of the portable electronic device, a plurality of successful user authentication entries;
Determining a location of the device corresponding to each of the successful user authentication entries; And
Storing, in computer-readable memory, data indicative of each of the entries and the corresponding location of each entry,
Determining the familiar area comprises determining the familiar area based on the respective entries and data indicative of a corresponding location of each entry;
Determining the location of the device,
Receiving satellite positioning system (GPS) data and determining the location based on the satellite positioning system data;
Receiving at least one network address corresponding to a wireless communication network detected by the device, and determining the location based on the network address; And
Determining the familiar area,
Determining a set of successful user authentication entries received during the time period,
Grouping entries from the set into a plurality of location-dependent subgroups,
Determining the size of the set and the size of each subgroup,
Identifying each subgroup having a size at least equal to a size threshold corresponding to a portion of the size of the set, and
For each subgroup having a size at least equal to the size threshold, classifying a location for entries in the subgroup as the familiar area. The method of claim 1,
Grouping entries from the set into a plurality of location dependent subgroups,
Identifying entries having locations within a threshold distance from each other; And
Grouping the identified entries into one of the subgroups. The method of claim 1,
Determining the familiar area,
Automatically and periodically collecting location information for the device;
Storing the location information in a memory;
Accessing, by the processor, the stored location information, and automatically determining a location where the location information is stored at least a threshold amount in the memory; And
Setting the determined location as the familiar area. The method of claim 1,
Determining the familiar area,
Automatically and periodically collecting location information for the device, the location information including satellite positioning system data and wireless network data;
Identifying, by the processor, where the device transitions from a global positioning system to a single wireless network; And
Setting the determined location as the familiar area. The method of claim 1,
Determining a current location of the device;
Determining that the current location is within the familiar area; And
Presenting a user prompt on the display of the device to perform the first authentication process. The method of claim 1,
And said processor and said computer-readable memory comprise elements of said portable electronic device. The method of claim 1,
The portable electronic device is in wireless communication with a server; And
And said processor and said computer-readable memory comprise elements of said server. The method of claim 1,
Automatically determining, by the processor, a second familiar area based on the data without requiring a user entry of location information; And
On the electronic device, when the device is in the second familiar area, enforcing a security rule that requires a third authentication process. The method of claim 1,
Wherein the first authentication process comprises an entry of a first password, and wherein the second authentication process comprises an entry of a second password. The method of claim 1,
Wherein the first authentication process comprises receiving a touch input, and wherein the second authentication process includes an entry of a second passcode. As an electronic device,
A processor;
User interface; And
Includes a memory with programming instructions,
The programming instructions, when executed, tell the processor:
Via the user interface, receive a request to access the electronic device;
Automatically determine a familiar area for the electronic device without requiring a user entry of location information;
Determine a current location for the electronic device;
Perform a first authentication process if the current location corresponds to the familiar area, and perform a second authentication process if the current location does not correspond to the familiar area;
Receive a plurality of successful user authentication entries;
Determine a location of the device corresponding to each of the successful user authentication entries;
Store data indicative of each of the entries and a corresponding location of each entry; And
Via the user interface, command to output a prompt for performing the performed authentication process;
Determining the familiar area includes determining the familiar area based on the respective entries and data indicative of a corresponding location of each entry;
Determining the location of the device,
Receiving satellite positioning system (GPS) data and determining the location based on the satellite positioning system data;
Receiving at least one network address corresponding to the detected wireless communication network, and determining the location based on the network address; And
Determining the familiar area,
Determine a set of successful user authentication entries received during the time period,
Group entries from the set into a plurality of location dependent subgroups,
Determine the size of the set and the size of each subgroup,
Identify each subgroup having a size at least equal to a size threshold corresponding to a portion of the size of the set,
For each subgroup having a size at least equal to the size threshold, classifying a location for entries in the subgroup as the familiar area. The method of claim 11,
The first authentication process and the second authentication process are as follows:
Length of timeout periods;
Number of authentication actions required; And
The types of authentication actions required;
At least one of which is different from each other. As a method for securing an electronic device,
Receiving, via an input of a portable electronic device, a request to access the electronic device; And
Automatically determining, by the processor, a first familiar area for the electronic device without requiring a user entry of location information,
The step of automatically determining the first familiar area,
Via input of the portable electronic device, receive a plurality of successful user authentication entries, each entry corresponding to a location,
In a computer-readable memory, storing data indicative of each said entry and the corresponding location of each entry,
Determine that the memory contains at least a threshold number of entries for a single location,
Classify the single location as the first familiar area, and
On the electronic device, when the electronic device is physically located within the first familiar area, enforce a first security rule that requires a first authentication process, and the electronic device may be located outside of any familiar area. And by enforcing a second security rule that requires a second authentication process. The method of claim 13,
Receiving, via the input, an additional successful user authentication entry corresponding to a location;
Determining if the memory already contains at least a threshold number of successful user authentication entries;
If the memory already contains at least the threshold number of successful user authentication entries, purging the oldest entry from the memory;
Storing in the memory data indicative of the additional successful user authentication entry;
Based on the stored data, determining one or more locations from which successful user authentication entries are most frequently generated; And
Classifying each of the determined one or more locations in which the successful user authentication entries are most frequently generated as a familiar area as a familiar area. The method of claim 13,
Automatically determining, by the processor, a second familiar area for the electronic device without requiring a user entry of location information,
Automatically determining the second familiar area,
Automatically and periodically collecting location information for the device,
Storing the collected location information in the memory,
Access, by the processor, the stored location information, the collected location information to automatically determine at least a threshold amount of stored location in the memory, and
And by setting the determined position as the second familiar area. The method of claim 13,
Automatically determining, by the processor, a second familiar area for the electronic device without requiring a user entry of location information,
Automatically determining the second familiar area,
Collect location information automatically and periodically for the device, the location information including satellite positioning system data and wireless network data;
Identify, by the processor, where the device transitions from a global positioning system to a single wireless network, and
And by setting the determined position as the second familiar area. A processor; And
Includes a memory with programming instructions,
The programming instructions, when executed, tell the processor:
Receive a plurality of successful user authentication entries for the portable electronic device, each entry corresponding to a location,
Storing data indicative of each of these entries and the corresponding location of each entry,
Determine that the memory contains at least a threshold number of entries for a single location,
Classify the single location as a first familiar area, without requiring a user entry of location information,
Receive a user request to access the electronic device,
In response to the user request, determine a current location for the electronic device,
If the current location corresponds to the first familiar area, perform a first authentication process; if the current location does not correspond to any familiar area, perform a second authentication process, and
And output a prompt for performing the authentication process that is performed. The method of claim 17,
When executed, tell the processor:
Receive an additional successful user authentication entry corresponding to the location;
Determine whether the memory already contains at least a threshold number of successful user authentication entries;
If the memory already contains at least the threshold number of successful user authentication entries, remove the oldest entry from the memory;
Store in the memory data indicative of the additional successful user authentication entry;
Based on the stored data, determine one or more locations from which successful user authentication entries were most frequently generated; And
Further programming instructions instructing the successful user authentication entries to classify each of the determined one or more locations in which the most frequently generated entries as a familiar area. The method of claim 17,
When executed, further includes additional programming instructions to instruct the processor to determine a second familiar area for the electronic device,
Determining the second familiar area,
Automatically and periodically collecting location information for the device,
Storing the collected location information in the memory,
Access, by the processor, the stored location information, the collected location information to automatically determine at least a threshold amount of stored location in the memory, and
And setting the determined position as the second familiar area. The method of claim 17,
And said processor and said computer-readable memory comprise elements of said portable electronic device. The method of claim 17,
The portable electronic device is in wireless communication with a server; And
And wherein said processor and said computer-readable memory comprise elements of said server.

Images